avformat/mov: Check ctts_count before use
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 25 Feb 2015 12:00:51 +0000 (13:00 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 25 Feb 2015 12:31:34 +0000 (13:31 +0100)
Fixes out of array read
Fixes: asan_heap-oob_ae74b5_3610_cov_1739568095_test.3g2

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/mov.c

index 3d68ac8..5ff753d 100644 (file)
@@ -4191,7 +4191,11 @@ static AVIndexEntry *mov_find_next_sample(AVFormatContext *s, AVStream **st)
         if (msc->pb && msc->current_sample < avst->nb_index_entries) {
             AVIndexEntry *current_sample = &avst->index_entries[msc->current_sample];
             int64_t dts;
-            if (msc->ctts_data)
+
+            if (msc->ctts_data && msc->ctts_index >= msc->ctts_count)
+                av_log(s, AV_LOG_WARNING, "CTTS list too small\n");
+
+            if (msc->ctts_data && msc->ctts_index < msc->ctts_count)
                 dts = av_rescale(current_sample->timestamp - msc->dts_shift - msc->ctts_data[msc->ctts_index].duration,
                                  AV_TIME_BASE, msc->time_scale);
             else